To: 


Of: 


İCO. 


Information Commissioner's Office 


DATA PROTECTION ACT 1998 


SUPERVISORY POWERS OF THE INFORMATION COMMISSIONER 


MONETARY PENALTY NOTICE 


Reed Online Limited 


Academy Court, 94 Chancery Lane, London, WC2A 1DT 


The Information Commissioner (“the Commissioner”) has decided to 
issue Reed Online Limited (“ROL”) with a monetary penalty under 
section 55A of the Data Protection Act 1998 (“DPA”). The penalty is in 
relation to a serious contravention of Regulation 22 of the Privacy and 


Electronic Communications (EC Directive) Regulations 2003 (“PECR”). 


This notice explains the Commissioner’s decision. 


Legal framework 


ROL, whose registered office address is given above (Companies House 
Registration Number: 06317279) is the organisation stated in this 
notice to have transmitted unsolicited communications by means of 
electronic mail to individual subscribers for the purposes of direct 


marketing contrary to regulation 22 of PECR. 


Regulation 22 of PECR states: 
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"(1) This regulation applies to the transmission of unsolicited 


communications by means of electronic mail to individual 


subscribers. 


(2) Except in the circumstances referred to in paragraph (3), a person 
shall neither transmit, nor instigate the transmission of, unsolicited 
communications for the purposes of direct marketing by means of 
electronic mail unless the recipient of the electronic mail has 
previously notified the sender that he consents for the time being 
to such communications being sent by, or at the instigation of, the 


sender. 


(3) A person may send or instigate the sending of electronic mail for 


the purposes of direct marketing where— 


(a) that person has obtained the contact details of the recipient 
of that electronic mail in the course of the sale or 
negotiations for the sale of a product or service to that 


recipient; 


(b) the direct marketing is in respect of that person’s similar 


products and services only; and 


(c) the recipient has been given a simple means of refusing 
(free of charge except for the costs of the transmission of 
the refusal) the use of his contact details for the purposes 
of such direct marketing, at the time that the details were 
initially collected, and, where he did not initially refuse the 
use of the details, at the time of each subsequent 


communication. 


(4) A subscriber shall not permit his line to be used in contravention of 


paragraph (2).” 
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5. Section 122(5) of the Data Protection Act 2018 “DPA18” defines direct 
marketing as “the communication (by whatever means) of advertising 
or marketing material which is directed to particular individuals”. This 


definition also applies for the purposes of PECR (see regulation 2(2) 
PECR and paragraphs 430 & 432(6) to Schedule 19 of the DPA18). 


6. From 1 January 2021, consent in PECR has been defined by reference 
to the concept of consent in the UK GDPR as defined in section 3(10) of 
the DPA 2018!1!: see regulation 2(1) of PECR, as amended by Part 3 of 
Schedule 3, paragraph 44 of The Data Protection, Privacy and 
Electronic Communications (Amendments etc) (EU Exit) Regulations 
2019/419. Article 4(11) of the UK GDPR sets out the following 


wt 


definition: “‘consent’ of the data subject means any freely given, 
specific, informed and unambiguous indication of the data subject's 
wishes by which he or she, by a statement or by a clear affirmative 
action, signifies agreement to the processing of personal data relating 


to him or her". 


7. Recital 32 of the UK GDPR materially states that “When the processing 
has multiple purposes, consent should be given for all of them”. Recital 
42 materially provides that “For consent to be informed, the data subject 
Should be aware at least of the identity of the controller”. Recital 43 
materially states that “Consent is presumed not to be freely given if it 
does not allow separate consent to be given to different personal data 


processing operations despite it being appropriate in the individual case”. 


8. “Individual” is defined in regulation 2(1) of PECR as “a living individual 


and includes an unincorporated body of such individuals”. 


{11 The UK GDPR is therein defined as Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 
April 2016 (“GDPR”) as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue 
of section 3 of the European Union (Withdrawal) Act 2018. 
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A “subscriber” is defined in regulation 2(1) of PECR as “a person who is 


a party to a contract with a provider of public electronic 


communications services for the supply of such services”. 


“Electronic mail” is defined in regulation 2(1) of PECR as “any text, 
voice, sound or image message sent over a public electronic 
communications network which can be stored in the network or in the 
recipient’s terminal equipment until it is collected by the recipient and 


includes messages sent using a short message service”. 


The term "soft opt-in" is used to describe the rule set out in in 
Regulation 22(3) of PECR. In essence, an organisation may be able to 
e-mail its existing customers even if they haven't specifically consented 
to electronic mail. The soft opt-in rule can only be relied upon by the 


organisation that collected the contact details 


Section 55A of the DPA (as applied to PECR cases by Schedule 1 to 


PECR, as variously amended) states: 


"(1) The Commissioner may serve a person with a monetary penalty if 


the Commissioner is satisfied that - 


(a) there has been a serious contravention of the requirements 
of the Privacy and Electronic Communications (EC 


Directive) Regulations 2003 by the person, 
(b) subsection (2) or (3) applies. 
(2) This subsection applies if the contravention was deliberate. 
(3) This subsection applies if the person - 


(a) knew or ought to have known that there was a risk that the 


contravention would occur, but 
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(b) failed to take reasonable steps to prevent the 


contravention.” 


The Commissioner has issued statutory guidance under section 55C (1) 
of the DPA about the issuing of monetary penalties that has been 
published on the ICO’s website. The Data Protection (Monetary 
Penalties) (Maximum Penalty and Notices) Regulations 2010 prescribe 
that the amount of any penalty determined by the Commissioner must 
not exceed £500,000. 


PECR were enacted to protect the individual’s fundamental right to 
privacy in the electronic communications sector. PECR were 
subsequently amended and strengthened. The Commissioner will 
interpret PECR in a way which is consistent with the Regulations’ 
overall aim of ensuring high levels of protection for individuals’ privacy 


rights. 


The provisions of the DPA remain in force for the purposes of PECR 
notwithstanding the introduction of the DPA18: see paragraph 58(1) of 
Schedule 20 to the DPA18. 


Background to the case 


Complaints 
ROL provides a platform to assist users with finding work and career 


enhancement throughout their careers. 


ROL came to the attention of the ICO by seven complaints being made 
through the ICO Spam reporting facility. The complaints were about 
marketing emails sent by Reed Online Limited with the subject title 


“Have your CV reviewed by the professionals.” The email invited 
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individuals to submit their CVs to be reviewed by an organisation 


named as i. 


The complainants were asked to provide the emails that they had 


received and give further details. Below are the responses received: 


“In terms of additional information, I can add that I suspect I’m not the 
only person to have received this particular email (despite the no 
contact preferences). My partner for instance also mentioned rather 
irritatedly that she had received the same email albeit some time later 
the same day, this is despite also having the same preferences to 
receive nothing from Reed. Much like myself she followed the 
unsubscribe link to check/unsubscribe again but found that their site 
attempts to trick you into resubscribing (layout/wording) but that 
everything was indeed disabled. I have since asked Reed to remove 
my account/data to avoid a repeat as nether myself or my partner 
have been looking for a role for some 3 years. It is however rather 
disconcerting to be sent these kinds of emails in the midst of a 
pandemic when jobs are in some instances less secure (I work in the 
wedding/events space currently) and its irritating that their unwelcome 


marketing in my mind is an attempt to turn this to their favour.” 


“As requested, forwarded email below. Although the email says at the 
bottom “you have agreed to receive Job News emails” this is incorrect. 
I logged in and checked my preferences and confirmed I had opted out 


of all contact.” 


“I contacted the Company on the day the email arrived and had an 
acknowledgement and apology on the same day (5th February) with a 
commitment to explain why this happened. I have however heard 


nothing further in the intervening 2 weeks.” 
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The Investigation 
An initial investigation letter was sent to ROL on 18 February 2021. 


On 19 February 2021 ROL responded acknowledging the letter and 
stated “We are fully aware of the systems incident on 4 February 2021 
where an email was sent in error to users of our services. This issue 
which caused the email to be sent has been identified and has since 
been rectified. We will now provide you with all the information you 
have required as soon as we can in order for you to complete your 


investigation.” 


On 3 March 2021 ROL sent an email to the ICO requesting an extension 


due to staff working from home during the pandemic. 


On 8 March 2021 a response was sent from the ICO to ROL granting 


the extension. 


On 18 March 2021 a detailed response was received from ROL 


including an attachment titled ‘PECR Training Manual’. 


23.1 They stated that an incident had occurred overnight on 4 
February 2021; the email in question had been sent to every 
jobseeker on their database as a scheduled campaign. It was 
sent by their new Customer Relationship Management system, 
GR. The migration from their old system to the new EE 


system was scheduled for and took place on 5 February 2021. 


23.2 They stated the following “As part of the migration process, ROL 
undertook an exercise to condense the number of campaign 
proposals and subsequent variations within the [lj system to 


drive better consistency and efficiency. These campaigns fell into 
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either Marketing or Transactional/Service emails, mostly set up 
to mirror the equivalents in Salesforce, with some new 
campaigns created. Within BE, there is functionality to set up 
a Scheduled campaign or a Triggered campaign. Triggered 


campaigns remain dormant in the system until such time as they 


are signed off and become Scheduled.” 


ROL stated that the incident had occurred because of human 
error; “the Email which had the dormant Triggered status, was 
accidentally switched to be treated as Scheduled.” The email 


was sent to the entire database. 


They stated that "whilst unsubscribe/suppression lists are in 
place and operated by ROL, the error also resulted in the Email 
being classified as a Transactional email (as opposed to a 
Marketing email), and therefore bypassed the users’ marketing 
preference settings. The Email was, in fact, never intended to be 


sent, nor was it sent for the purposes of direct marketing.” 


They went on to say that “when users were clicking to 
unsubscribe (every Marketing email carries an unsubscribe 
function), they saw a notification that they were already 
unsubscribed, prompting frustration as to why they had received 
the email. However, the system was working as intended; these 
users were unsubscribed from Marketing emails (and still are). 
ROL fixed the issue without delay in order to prevent further 
frustration from users, in addition to highlighting the error in a 


message on its website.” 


ROL identified several issues that led to the emails being sent: 


23.8 
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23.6.1 “The [I system allowed an operator the ability to 
switch a campaign from being in a Triggered state toa 


Scheduled state without raising a flag, undergoing formal 


review and achieving sign off state.” 


23.6.2 “The [I system allowed the Email to go to over 18 


million people without raising a flag or sign off request.” 


23.6.3 “Due to the large number of email recipients, the 
email deliveries took place over a period of 2.5 days. Once 
the email had been sent, ROL was unable to recall it from 


the email service providers.” 


ROL stated that they had taken immediate action to implement 
new quality assurance to prevent a campaign type being 
switched to ‘scheduled’ without review and sign off. Further that 
they are “re-considering ANY scheduled emails outside 

of core working hours and looking into options around email 
recall capabilities within J” and additional system 
functionality considerations are being looked at to add 
“automated flag or sign off requirements for email transmissions 


above a certain threshold.” 


In relation to ROL’s relationship with MM, they stated that 
they have "a relationship with [MM for it to provide CV writing 
services directly to ROL's users who elect to make use of BE 
services. J services are promoted by ROL on ROL’s 
website only ... After a user is registered with ROL, they are given 
the opportunity, on the ROL website, to interact with ii 


directly to assist with CV writing skills. The message appearing 
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on the sign-up screen states: “By ticking this box, you agree that 

ROL will share your full name, email address and CV 

with B. They will contact you directly via email to provide 

feedback on your CV and inform you of their CV writing services. 

View [BM privacy policy.” Should the user elect this option, 

they are contacted by [ directly to assist with their CV 


writing services.” 


23.9 Those who clicked on the email were taken to their own accounts 


on the ROL website and their details were never provided to 


23.10ROL stated that “the Incident occurred as a result of a human 
error during the E implementation process and ROL has 
already put in place changes to avoid repetition. ROL did not 
profit in any way from this innocent error and believes it operates 


a robust privacy compliant programme.” 


23.11In relation to the PECR Training Manual, it contained information 
for employees about PECR and fines monetary penalties issued 
by the ICO to other organisations for contraventions. Reed Online 
Limited recognised that their training could be improved, and 
they have developed a specific PECR training module which was 
delivered on 16 March 2021 to all marketing staff and senior 
leadership team. The session was delivered by the Data 
Protection Officer and head of Data Management. Further, for 
new employees, viewing of a recorded version of the training will 
be mandatory and there will be an annual refresher course for 


existing staff. 
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On 22 March 2021 further enquiries were sent to ROL by the ICO. 


On 26 March 2021 a response was received. The response reiterated 
the position that the incident was a result of human error, and that 
ROL was confident that Regulation 22 of PECR 2003 could not apply in 
these circumstances; the email was not sent for the purposes of direct 
marketing and there was no intention to send the email. There was no 
purpose to the sending of the email and as such it could not be said 
that the email was sent for the purposes of direct marketing. ROL 
confirmed that 16,983,447 of the emails it sent were received by the 
addressee, and 6,250,966 of those were received by individuals who 


were unsubscribed from receiving direct marketing emails. 
On 1 April 2021 further enquiries were sent to ROL by the ICO. 
On 8 April 2021 a response was received: 


27.1 of the 16,983,447 received emails, 77,101 recipients clicked on 


the link ‘Claim your free CV review’ 


27.2 of the 16,983,447 received emails, 256,418 recipients clicked on 


the unsubscribe link 


27.3 of the 6,250,966 received emails sent to individuals who were 
unsubscribed from receiving marketing emails from ROL, 37,011 


recipients clicked on the link ‘Claim your free CV review’ 


27.4 of the 6,250,966 received emails sent to individuals who were 
unsubscribed from receiving marketing emails, 227,063 


recipients clicked on the unsubscribe link 
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On 13 May 2021 the ICO wrote to ROL to say the investigation had 


been concluded and that a decision would be made whether any 


regulatory action would be taken. 


On 8 September 2021 the ICO wrote to ROL asking for some additional 
information. ROL requested an extension to provide their response, 


which was granted. 


On 30 September 2021 ROL provided their response which included a 
process map which outlined the process for the incident from inception 


through to sending. Within the response, ROL stated the following: 
a. The email was drafted in 2016. 


b. They believe the email would have been drafted by the person 
who held the role of Senior CRM Manager/Senior Email Developer 


or similar title. 


c. In 2021, there was no intention of sending the email out. The 
email was used in a campaign that ran from 7 July 2016 to 
January 2020. The email was sent in a targeted way, with a 


monthly average or 9,290 emails. 


d. The email was moved in February 2021 to the new system as 


part of the migration of all emails. 


e. The email was sent as part of an automated process following its 
status accidentally being switched from marketing (which would 
require human intervention for it to be sent) to transactional 
(which is sent automatically at a scheduled time). The email was 


then sent at the first available point after the migration to the 
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new system. A senior member of staff switched the status of the 


email. 


There is some discrepancy in the text of the response and the detail in 
the process map as to when the initial error described above occurred, 
it was either August 2020 or October 2020. 


The Commissioner has made the above findings of fact on the 


balance of probabilities. 


The Commissioner has considered whether those facts constitute 
a contravention of regulation 22 of PECR by ROL and, if so, whether 


the conditions of section 55A DPA are satisfied. 

The contravention 

The Commissioner finds that ROL contravened regulation 22 of PECR. 
The Commissioner finds that the contravention was as follows: 


The Commissioner finds that between 4 February 2021 and 7 February 
2021 there were 6,250,966 direct marketing emails received by 
subscribers. The Commissioner finds that ROL transmitted those direct 


marketing messages, contrary to regulation 22 of PECR. 


ROL, as the sender of the direct marketing, is required to ensure that it 
is acting in compliance with the requirements of regulation 22 of PECR, 
and to ensure that valid consent to send those messages had been 


acquired. 


For consent to be valid it is required to be “freely given”, by which it 


follows that if consent to marketing is a condition of subscribing to a 
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service, the organisation will have to demonstrate how the consent can 


be said to have been given freely. 


Consent is also required to be “specific” as to the type of marketing 
communication to be received, and the organisation, or specific type of 


organisation, that will be sending it. 


ROL have asserted that their actions do not amount to a breach of 
regulation 22 as there was no intention to send the email for the 
purposes of direct marketing. While the Commissioner accepts that the 
contravention occurred due to human error, he nonetheless is satisfied 
that intention is not a necessary element and that there was a 


contravention. 


The regulations do not require an intention on the part of the sender. 
The focus of the legislation is on protecting individuals from receiving 
unsolicited communications which contain direct marketing material 
however they may be sent, rather than being concerned with the intent 
(or lack of) of the sender behind the actual transmission of the 


communication. 


In this instance, consent remains a relevant consideration and consent 
had not been given; the recipients had not consented to direct 
marketing. ROL accept that consent was not given, but submit that 


someone cannot consent to an unintentional communication. 


The Commissioner is therefore satisfied from the evidence he has seen 
that ROL did not have the necessary valid consent for the 6,250,966 


direct marketing messages received by subscribers. 
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The Commissioner has gone on to consider whether the conditions 


under section 55A DPA are met. 
Seriousness of the contravention 


The Commissioner is satisfied that the contravention identified 
above was serious. This is because between 4 February 2021 and 7 
February 2021 a confirmed total of 6,250,966 direct marketing 
messages were sent by ROL. These messages contained direct 
marketing material for which subscribers had not provided valid 
consent. Furthermore, the Commissioner is satisfied that ROL cannot 


rely on the soft opt-in exemption. 


The total number of direct marketing messages sent during the 
incident was 16,983,447; 37% of those (6,250,966) were people who 
had unsubscribed from receiving marketing emails. This is a high 


number of people affected. 


The Commissioner is therefore satisfied that condition (a) from 
section 55A (1) DPA is met. 


Deliberate or negligent contraventions 


The Commissioner has considered whether the contravention identified 
above was deliberate. In the Commissioner’s view, this means that 
ROL’S actions which constituted that contravention were deliberate 
actions (even if ROL did not actually intend thereby to contravene 
PECR). 


The Commissioner does not consider that ROL deliberately set out to 


contravene PECR in this instance. 
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The Commissioner has gone on to consider whether the contravention 
identified above was negligent. This consideration comprises two 


elements: 


Firstly, he has considered whether ROL knew or ought reasonably to 
have known that there was a risk that these contraventions would 
occur. He is satisfied that this condition is met, for the following 
reasons: 

a. ROL have a high proportion of opted out clients, therefore it is 
reasonable to expect that they should be proactive in ensuring 
measures were in place to avoid a high-risk contravention. 

b. Preventative measures such as a two-step process and checks 


along the way were clearly lacking. 


The Commissioner has published detailed guidance for those carrying 
out direct marketing explaining their legal obligations under PECR. 

This guidance gives clear advice regarding the requirements of consent 
for direct marketing and explains the circumstances under which 
organisations are able to carry out marketing over the phone, by text, 
by email, by post, or by fax. In particular, it states that organisations 
can generally only send, or instigate, marketing messages to 
individuals if that person has specifically consented to receiving them; 
and highlights the difficulties of relying on indirect consent for 
electronic mail. The guidance also provides a full explanation of the 
“soft opt-in” exemption. The Commissioner has also published detailed 
guidance on consent under the GDPR. In case organisations remain 
unclear on their obligations, the ICO operates a telephone helpline. ICO 
communications about previous enforcement action where businesses 


have not complied with PECR are also readily available. 
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It is therefore reasonable to suppose that ROL should have been aware 


of its responsibilities in this area. 


Secondly, the Commissioner has gone on to consider whether ROL 
failed to take reasonable steps to prevent the contraventions. Again, he 


is satisfied that this condition is met. 


ROL had unsubscribe/suppression lists in place, yet the email was 
classified incorrectly as a transactional email and therefore bypassed 
those lists. The email was set at ‘scheduled’ status from 
August/October 2020 until it was sent out in February 2021. The 
Quality Assurance process was lacking as it failed to identify and 


correct this error during the intervening period. 


ROL have identified action to prevent further incidents such as this 


occurring; these should have been in place in the first instance. 


In the circumstances, the commissioner acknowledges that ROL had 
processes and checks in place but on this occasion those processes and 
checks were inadequate. The Commissioner is therefore satisfied that 


ROL failed to take reasonable steps to prevent the contraventions. 


The Commissioner is therefore satisfied that condition (b) from section 
55A (1) DPA is met. 


The Commissioner's decision to issue a monetary penalty 


The Commissioner has taken into account the following mitigating 


feature of this case: 


e Steps taken by the organisation 
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ROL has developed a specific PECR training module for staff. The 
organisation has stated that the IT issue which led to the 
contravention being possible has been fixed. ROL are now solely 
operating a new Customer Relationship Management system 


e The contravention occurred as a result of human error 


For the reasons explained above, the Commissioner is satisfied that the 
conditions from section 55A (1) DPA have been met in this case. He is 
also satisfied that the procedural rights under section 55B have been 


complied with. 


The latter has included the issuing of a Notice of Intent, in which the 
Commissioner set out his preliminary thinking. In reaching his final 
view, the Commissioner has taken into account the representations 


made by ROL on this matter. 


The Commissioner is accordingly entitled to issue a monetary penalty 


in this case. 


The Commissioner has considered whether, in the circumstances, he 


should exercise his discretion so as to issue a monetary penalty. 


The Commissioner has considered the likely impact of a monetary 
penalty on ROL. He has decided on the information that is available to 
him, that ROL has access to sufficient financial resources to pay the 


proposed monetary penalty without causing undue financial hardship. 


The Commissioner’s underlying objective in imposing a monetary 
penalty notice is to promote compliance with PECR. The sending of 


unsolicited direct marketing messages is a matter of significant public 
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concern. A monetary penalty in this case should act as a general 
encouragement towards compliance with the law, or at least as a 
deterrent against non-compliance, on the part of all persons running 
businesses currently engaging in these practices. The issuing of a 
monetary penalty will reinforce the need for businesses to ensure that 
they are only messaging those who specifically consent to receive 


direct marketing. 


For these reasons, the Commissioner has decided to issue a monetary 


penalty in this case. 


The amount of the penalty 


Taking into account all of the above, the Commissioner has decided 
that a penalty in the sum of £40,000 (forty-thousand pounds) is 
reasonable and proportionate given the particular facts of the case and 


the underlying objective in imposing the penalty. 


The monetary penalty must be paid to the Commissioner’s office by 
BACS transfer or cheque by 20 May 2022 at the latest. The monetary 
penalty is not kept by the Commissioner but will be paid into the 
Consolidated Fund which is the Government’s general bank account at 
the Bank of England. 


If the Commissioner receives full payment of the monetary penalty by 
19 May 2022 the Commissioner will reduce the monetary penalty by 
20% to £32,000 (thirty two thousand pounds). However, you 
should be aware that the early payment discount is not available if you 


decide to exercise your right of appeal. 


There is a right of appeal to the First-tier Tribunal (Information Rights) 


against: 
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(a) the imposition of the monetary penalty 
and/or; 
(b) the amount of the penalty specified in the monetary penalty 


notice. 


Any notice of appeal should be received by the Tribunal within 28 days 


of the date of this monetary penalty notice. 
Information about appeals is set out in Annex 1. 


The Commissioner will not take action to enforce a monetary penalty 


unless: 


e the period specified within the notice within which a monetary 
penalty must be paid has expired and all or any of the monetary 


penalty has not been paid; 


e all relevant appeals against the monetary penalty notice and any 


variation of it have either been decided or withdrawn; and 


e the period for appealing against the monetary penalty and any 


variation of it has expired. 


In England, Wales and Northern Ireland, the monetary penalty is 
recoverable by Order of the County Court or the High Court. In 
Scotland, the monetary penalty can be enforced in the same manner as 
an extract registered decree arbitral bearing a warrant for execution 


issued by the sheriff court of any sheriffdom in Scotland. 
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Dated the 20t Day of April 2022 


Andy Curry 

Head of Investigations 
Information Commissioner's Office 
Wycliffe House 

Water Lane 

Wilmslow 

Cheshire 

SK9 5AF 
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ANNEX 1 
SECTION 55 A-E OF THE DATA PROTECTION ACT 1998 
RIGHTS OF APPEAL AGAINST DECISIONS OF THE COMMISSIONER 


L. Section 55B(5) of the Data Protection Act 1998 gives any person 
upon whom a monetary penalty notice has been served a right of 
appeal to the First-tier Tribunal (Information Rights) (the ‘Tribunal’) 


against the notice. 
2. If you decide to appeal and if the Tribunal considers:- 


a) that the notice against which the appeal is brought is not in 


accordance with the law; or 


b) to the extent that the notice involved an exercise of 
discretion by the Commissioner, that he ought to have exercised 


his discretion differently, 


the Tribunal will allow the appeal or substitute such other decision as 
could have been made by the Commissioner. In any other case the 


Tribunal will dismiss the appeal. 


3: You may bring an appeal by serving a notice of appeal on the 


Tribunal at the following address: 


General Regulatory Chamber 
HM Courts & Tribunals Service 
PO Box 9300 

Leicester 

LEi 8DJ 
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Telephone: 0203 936 8963 
Email: grc@justice.gov.uk 


a) The notice of appeal should be sent so it is received by the 


Tribunal within 28 days of the date of the notice. 

b) If your notice of appeal is late the Tribunal will not admit it 
unless the Tribunal has extended the time for complying with this 
rule. 


The notice of appeal should state: - 


a) your name and address/name and address of your 


representative (if any); 


b) an address where documents may be sent or delivered to 


you; 

c) the name and address of the Information Commissioner; 
d) details of the decision to which the proceedings relate; 
e) the result that you are seeking; 

f) the grounds on which you rely; 


g) you must provide with the notice of appeal a copy of the 


monetary penalty notice or variation notice; 


h) if you have exceeded the time limit mentioned above the 


notice of appeal must include a request for an extension of time 
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and the reason why the notice of appeal was not provided in 


time. 


5. Before deciding whether or not to appeal you may wish to consult 
your solicitor or another adviser. At the hearing of an appeal a party 
may conduct his case himself or may be represented by any person 


whom he may appoint for that purpose. 


6. The statutory provisions concerning appeals to the First-tier 
Tribunal (Information Rights) are contained in section 55B(5) of, and 
Schedule 6 to, the Data Protection Act 1998, and Tribunal Procedure 
(First-tier Tribunal) (General Regulatory Chamber) Rules 2009 
(Statutory Instrument 2009 No. 1976 (L.20)). 
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